diff options
Diffstat (limited to 'net')
| -rw-r--r-- | net/cert/cert_verify_proc_mac.cc | 3 | ||||
| -rw-r--r-- | net/cert/test_root_certs_mac.cc | 47 |
2 files changed, 14 insertions, 36 deletions
diff --git a/net/cert/cert_verify_proc_mac.cc b/net/cert/cert_verify_proc_mac.cc index b082e34..77346df 100644 --- a/net/cert/cert_verify_proc_mac.cc +++ b/net/cert/cert_verify_proc_mac.cc @@ -559,8 +559,7 @@ int CertVerifyProcMac::VerifyInternal( if (flags & CertVerifier::VERIFY_EV_CERT) { // Determine the certificate's EV status using SecTrustCopyExtendedResult(), - // which we need to look up because the function wasn't added until - // Mac OS X 10.5.7. + // which is an internal/private API function added in OS X 10.5.7. // Note: "ExtendedResult" means extended validation results. CFBundleRef bundle = CFBundleGetBundleWithIdentifier(CFSTR("com.apple.security")); diff --git a/net/cert/test_root_certs_mac.cc b/net/cert/test_root_certs_mac.cc index 475fb24..2728248 100644 --- a/net/cert/test_root_certs_mac.cc +++ b/net/cert/test_root_certs_mac.cc @@ -7,6 +7,7 @@ #include <Security/Security.h> #include "base/logging.h" +#include "base/mac/mac_util.h" #include "base/mac/scoped_cftyperef.h" #include "net/cert/x509_certificate.h" @@ -68,50 +69,28 @@ OSStatus TestRootCerts::FixupSecTrustRef(SecTrustRef trust_ref) const { if (IsEmpty()) return noErr; - CFBundleRef bundle = - CFBundleGetBundleWithIdentifier(CFSTR("com.apple.security")); - SecTrustSetAnchorCertificatesOnlyFuncPtr set_anchor_certificates_only = NULL; - if (bundle) { - set_anchor_certificates_only = - reinterpret_cast<SecTrustSetAnchorCertificatesOnlyFuncPtr>( - CFBundleGetFunctionPointerForName(bundle, - CFSTR("SecTrustSetAnchorCertificatesOnly"))); - } - - OSStatus status = noErr; - if (set_anchor_certificates_only) { - // OS X 10.6 includes a function where the system trusts can be - // preserved while appending application trusts. This is preferable, - // because it preserves any user trust settings (explicit distrust), - // which the naive copy in 10.5 does not. Unfortunately, though the - // function pointer may be available, it is not always implemented. If it - // returns errSecUnimplemented, fall through to the 10.5 behaviour. - status = SecTrustSetAnchorCertificates(trust_ref, temporary_roots_); - if (status) - return status; - status = set_anchor_certificates_only(trust_ref, false); - if (status != errSecUnimplemented) - return status; - - // Restore the original settings before falling back. - status = SecTrustSetAnchorCertificates(trust_ref, NULL); + // Despite SecTrustSetAnchorCertificatesOnly existing in OS X 10.6, and + // being documented as available, it is not actually implemented. On 10.7+, + // however, it always works. + if (base::mac::IsOSLionOrLater()) { + OSStatus status = SecTrustSetAnchorCertificates(trust_ref, + temporary_roots_); if (status) return status; + // Trust system store in addition to trusting |temporary_roots_|. + return SecTrustSetAnchorCertificatesOnly(trust_ref, false); } - // On 10.5, the system certificates have to be copied and merged into - // the application trusts, and may override any user trust settings. + // For OS X 10.6, emulate the functionality by copying the system roots + // in addition to |temporary_roots_|. CFArrayRef system_roots = NULL; - status = SecTrustCopyAnchorCertificates(&system_roots); + OSStatus status = SecTrustCopyAnchorCertificates(&system_roots); if (status) return status; base::mac::ScopedCFTypeRef<CFArrayRef> scoped_system_roots(system_roots); base::mac::ScopedCFTypeRef<CFMutableArrayRef> scoped_roots( - CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, - scoped_system_roots)); - DCHECK(scoped_roots.get()); - + CFArrayCreateMutableCopy(kCFAllocatorDefault, 0, scoped_system_roots)); CFArrayAppendArray(scoped_roots, temporary_roots_, CFRangeMake(0, CFArrayGetCount(temporary_roots_))); return SecTrustSetAnchorCertificates(trust_ref, scoped_roots); |